@agoric/swingset-liveslots 0.10.3-upgrade-14-dev-c8f9e7b.0 → 0.10.3-upgrade-16-dev-8879538.0

package/src/virtualObjectManager.js

@@ -1,7 +1,13 @@
 /* global globalThis */
 /* eslint-disable no-use-before-define, jsdoc/require-returns-type */
 
-import { assert, Fail } from '@agoric/assert';
+import { environmentOptionsListHas } from '@endo/env-options';
+import {
+  assert,
+  throwRedacted as Fail,
+  quote as q,
+  bare as b,
+} from '@endo/errors';
 import { assertPattern, mustMatch } from '@agoric/store';
 import { defendPrototype, defendPrototypeKit } from '@endo/exo/tools.js';
 import { Far, passStyleOf } from '@endo/marshal';
@@ -14,17 +20,22 @@ import {
   checkAndUpdateFacetiousness,
 } from './facetiousness.js';
 
-/** @template T @typedef {import('@agoric/vat-data').DefineKindOptions<T>} DefineKindOptions */
+/**
+ * @import {DurableKindHandle} from '@agoric/swingset-liveslots'
+ * @import {DefineKindOptions} from '@agoric/swingset-liveslots'
+ * @import {ClassContextProvider, KitContextProvider} from '@endo/exo'
+ * @import {ToCapData, FromCapData} from '@endo/marshal';
+ */
 
-const { hasOwn, defineProperty, getOwnPropertyNames } = Object;
+const {
+  hasOwn,
+  defineProperty,
+  getOwnPropertyNames,
+  values,
+  entries,
+  fromEntries,
+} = Object;
 const { ownKeys } = Reflect;
-const { quote: q } = assert;
-
-// import { kdebug } from './kdebug.js';
-
-// TODO Use environment-options.js currently in ses/src after factoring it out
-// to a new package.
-const env = (globalThis.process || {}).env || {};
 
 // Turn on to give each exo instance its own toStringTag value which exposes
 // the SwingSet vref.
@@ -33,9 +44,7 @@ const env = (globalThis.process || {}).env || {};
 // confidential object-creation activity, so this must not be something
 // that unprivileged vat code (including unprivileged contracts) can do
 // for themselves.
-const LABEL_INSTANCES = (env.DEBUG || '')
-  .split(':')
-  .includes('label-instances');
+const LABEL_INSTANCES = environmentOptionsListHas('DEBUG', 'label-instances');
 
 // This file implements the "Virtual Objects" system, currently documented in
 // {@link https://github.com/Agoric/agoric-sdk/blob/master/packages/SwingSet/docs/virtual-objects.md})
@@ -132,40 +141,6 @@ const makeContextCache = (makeState, makeContext) => {
   return makeCache(readBacking, writeBacking, deleteBacking);
 };
 
-/**
- * @typedef {import('@endo/exo/src/exo-tools.js').ContextProvider } ContextProvider
- */
-
-/**
- * @param {*} contextCache
- * @param {*} getSlotForVal
- * @returns {ContextProvider}
- */
-const makeContextProvider = (contextCache, getSlotForVal) => {
-  return harden(rep => contextCache.get(getSlotForVal(rep)));
-};
-
-const makeContextProviderKit = (contextCache, getSlotForVal, facetNames) => {
-  /** @type { Record<string, any> } */
-  const contextProviderKit = {};
-  for (const [index, name] of facetNames.entries()) {
-    contextProviderKit[name] = rep => {
-      const vref = getSlotForVal(rep);
-      const { baseRef, facet } = parseVatSlot(vref);
-
-      // Without this check, an attacker (with access to both cohort1.facetA
-      // and cohort2.facetB) could effectively forge access to cohort1.facetB
-      // and cohort2.facetA. They could not forge the identity of those two
-      // objects, but they could invoke all their equivalent methods, by using
-      // e.g. cohort1.facetA.foo.apply(cohort2.facetB, [...args])
-      Number(facet) === index || Fail`illegal cross-facet access`;
-
-      return harden(contextCache.get(baseRef));
-    };
-  }
-  return harden(contextProviderKit);
-};
-
 // The management of single Representatives (i.e. defineKind) is very similar
 // to that of a cohort of facets (i.e. defineKindMulti). In this description,
 // we use "self/facets" to refer to either 'self' or 'facets', as appropriate
@@ -260,15 +235,15 @@ const makeFacets = (
 };
 
 const insistDurableCapdata = (vrm, what, capdata, valueFor) => {
-  capdata.slots.forEach((vref, idx) => {
+  for (const [idx, vref] of entries(capdata.slots)) {
     if (!vrm.isDurable(vref)) {
       if (valueFor) {
-        Fail`value for ${what} is not durable: slot ${q(idx)} of ${capdata}`;
+        Fail`value for ${what} is not durable: slot ${b(idx)} of ${capdata}`;
       } else {
-        Fail`${what} is not durable: slot ${q(idx)} of ${capdata}`;
+        Fail`${what} is not durable: slot ${b(idx)} of ${capdata}`;
       }
     }
-  });
+  }
 };
 
 const insistSameCapData = (oldCD, newCD) => {
@@ -281,11 +256,11 @@ const insistSameCapData = (oldCD, newCD) => {
   if (oldCD.slots.length !== newCD.slots.length) {
     Fail`durable Kind stateShape mismatch (slots.length)`;
   }
-  oldCD.slots.forEach((oldVref, idx) => {
+  for (const [idx, oldVref] of entries(oldCD.slots)) {
     if (newCD.slots[idx] !== oldVref) {
       Fail`durable Kind stateShape mismatch (slot[${idx}])`;
     }
-  });
+  }
 };
 
 /**
@@ -302,11 +277,11 @@ const insistSameCapData = (oldCD, newCD) => {
  * @param {(slot: string) => object} requiredValForSlot
  * @param {*} registerValue  Function to register a new slot+value in liveSlot's
  *   various tables
- * @param {import('@endo/marshal').ToCapData<string>} serialize  Serializer for this vat
- * @param {import('@endo/marshal').FromCapData<string>} unserialize  Unserializer for this vat
+ * @param {ToCapData<string>} serialize  Serializer for this vat
+ * @param {FromCapData<string>} unserialize  Unserializer for this vat
  * @param {*} assertAcceptableSyscallCapdataSize  Function to check for oversized
  *   syscall params
- * @param {import('./types').LiveSlotsOptions} [liveSlotsOptions]
+ * @param {import('./types.js').LiveSlotsOptions} [liveSlotsOptions]
  * @param {{ WeakMap: typeof WeakMap, WeakSet: typeof WeakSet }} [powers]
  * Specifying the underlying WeakMap/WeakSet objects to wrap with
  * VirtualObjectAwareWeakMap/Set.  By default, capture the ones currently
@@ -314,7 +289,7 @@ const insistSameCapData = (oldCD, newCD) => {
  * recursion if our returned WeakMap/WeakSet wrappers are subsequently installed
  * on globalThis.
  *
- * @returns {object} a new virtual object manager.
+ * @returns a new virtual object manager.
  *
  * The virtual object manager allows the creation of persistent objects that do
  * not need to occupy memory when they are not in use.  It provides five
@@ -707,10 +682,18 @@ export const makeVirtualObjectManager = (
     durableKindDescriptor = undefined, // only for durables
   ) => {
     const {
-      finish,
+      finish = undefined,
       stateShape = undefined,
+      receiveAmplifier = undefined,
+      receiveInstanceTester = undefined,
       thisfulMethods = false,
+    } = options;
+    let {
+      // These are "let" rather than "const" only to accommodate code
+      // below that tolerates an old version of the vat-data package.
+      // See there for more explanation.
       interfaceGuard = undefined,
+      interfaceGuardKit = undefined,
     } = options;
 
     const statePrototype = {}; // Not frozen yet
@@ -731,11 +714,35 @@ export const makeVirtualObjectManager = (
     switch (assessFacetiousness(behavior)) {
       case 'one': {
         assert(!multifaceted);
+        interfaceGuardKit === undefined ||
+          Fail`Use an interfaceGuard, not interfaceGuardKit, to protect class ${q(
+            tag,
+          )}`;
         proposedFacetNames = undefined;
         break;
       }
       case 'many': {
         assert(multifaceted);
+
+        if (interfaceGuard && interfaceGuardKit === undefined) {
+          // This if clause is for the purpose of tolerating versions
+          // of the vata-data package that precede
+          // https://github.com/Agoric/agoric-sdk/pull/8220 .
+          // Before that PR, the options name `interfaceGuard` would
+          // actually carry the InterfaceGuardKit.
+          //
+          // Tolerating the old vat-data with the new types.
+          // @ts-expect-error
+          interfaceGuardKit = interfaceGuard;
+          interfaceGuard = undefined;
+          // The rest of the code from here makes no further compromise
+          // for that old version of the vat-data package.
+        }
+
+        interfaceGuard === undefined ||
+          Fail`Use an interfaceGuardKit, not an interfaceGuard, to protect class kit ${q(
+            tag,
+          )}`;
         proposedFacetNames = ownKeys(behavior).sort();
         break;
       }
@@ -763,6 +770,11 @@ export const makeVirtualObjectManager = (
       Fail`A stateShape must be a copyRecord: ${q(stateShape)}`;
     assertPattern(stateShape);
 
+    if (!multifaceted) {
+      receiveAmplifier === undefined ||
+        Fail`Only facets of an exo class kit can be amplified, not ${q(tag)}`;
+    }
+
     let facetNames;
 
     if (isDurable) {
@@ -850,7 +862,9 @@ export const makeVirtualObjectManager = (
       return harden({
         get() {
           const baseRef = getBaseRef(this);
-          const { valueMap, capdatas } = dataCache.get(baseRef);
+          const record = dataCache.get(baseRef);
+          assert(record !== undefined);
+          const { valueMap, capdatas } = record;
           if (!valueMap.has(prop)) {
             const value = harden(unserialize(capdatas[prop]));
             checkStatePropertyValue(value, prop);
@@ -867,6 +881,7 @@ export const makeVirtualObjectManager = (
             insistDurableCapdata(vrm, prop, capdata, true);
           }
           const record = dataCache.get(baseRef); // mutable
+          assert(record !== undefined);
           const oldSlots = record.capdatas[prop].slots;
           const newSlots = capdata.slots;
           vrm.updateReferenceCounts(oldSlots, newSlots);
@@ -890,7 +905,9 @@ export const makeVirtualObjectManager = (
     const makeState = baseRef => {
       const state = { __proto__: statePrototype };
       if (stateShape === undefined) {
-        for (const prop of ownKeys(dataCache.get(baseRef).capdatas)) {
+        const record = dataCache.get(baseRef);
+        assert(record !== undefined);
+        for (const prop of ownKeys(record.capdatas)) {
           assert(typeof prop === 'string');
           checkStateProperty(prop);
           defineProperty(state, prop, makeFieldDescriptor(prop));
@@ -940,18 +957,57 @@ export const makeVirtualObjectManager = (
     // and into method-invocation time (which is not).
 
     let proto;
+    /** @type {ClassContextProvider | undefined} */
+    let contextProviderVar;
+    /** @type { Record<string, KitContextProvider> | undefined } */
+    let contextProviderKitVar;
+
     if (multifaceted) {
+      contextProviderKitVar = fromEntries(
+        facetNames.map((name, index) => [
+          name,
+          rep => {
+            const vref = getSlotForVal(rep);
+            if (vref === undefined) {
+              return undefined;
+            }
+            const { baseRef, facet } = parseVatSlot(vref);
+
+            // Without this check, an attacker (with access to both
+            // cohort1.facetA and cohort2.facetB)
+            // could effectively forge access to
+            // cohort1.facetB and cohort2.facetA.
+            // They could not forge the identity of those two
+            // objects, but they could invoke all their equivalent methods,
+            // by using e.g.
+            // cohort1.facetA.foo.apply(cohort2.facetB, [...args])
+            if (Number(facet) !== index) {
+              return undefined;
+            }
+
+            return harden(contextCache.get(baseRef));
+          },
+        ]),
+      );
+
       proto = defendPrototypeKit(
         tag,
-        makeContextProviderKit(contextCache, getSlotForVal, facetNames),
+        harden(contextProviderKitVar),
         behavior,
         thisfulMethods,
-        interfaceGuard,
+        interfaceGuardKit,
       );
     } else {
+      contextProviderVar = rep => {
+        const slot = getSlotForVal(rep);
+        if (slot === undefined) {
+          return undefined;
+        }
+        return harden(contextCache.get(slot));
+      };
       proto = defendPrototype(
         tag,
-        makeContextProvider(contextCache, getSlotForVal),
+        harden(contextProviderVar),
         behavior,
         thisfulMethods,
         interfaceGuard,
@@ -959,6 +1015,10 @@ export const makeVirtualObjectManager = (
     }
     harden(proto);
 
+    // All this to let typescript know that it won't vary during a closure
+    const contextProvider = contextProviderVar;
+    const contextProviderKit = contextProviderKitVar;
+
     // this builds new Representatives, both when creating a new instance and
     // for reanimating an existing one when the old rep gets GCed
 
@@ -973,10 +1033,11 @@ export const makeVirtualObjectManager = (
     const deleteStoredVO = baseRef => {
       let doMoreGC = false;
       const record = dataCache.get(baseRef);
+      assert(record !== undefined);
       for (const valueCD of Object.values(record.capdatas)) {
-        valueCD.slots.forEach(vref => {
+        for (const vref of valueCD.slots) {
           doMoreGC = vrm.removeReachableVref(vref) || doMoreGC;
-        });
+        }
       }
       dataCache.delete(baseRef);
       return doMoreGC;
@@ -1015,6 +1076,7 @@ export const makeVirtualObjectManager = (
         if (isDurable) {
           insistDurableCapdata(vrm, prop, valueCD, true);
         }
+        // eslint-disable-next-line github/array-foreach
         valueCD.slots.forEach(vrm.addReachableVref);
         capdatas[prop] = valueCD;
         valueMap.set(prop, value);
@@ -1030,10 +1092,63 @@ export const makeVirtualObjectManager = (
         val = makeRepresentative(proto, baseRef);
       }
       registerValue(baseRef, val, multifaceted);
-      finish?.(contextCache.get(baseRef));
+      finish && finish(contextCache.get(baseRef));
       return val;
     };
 
+    if (receiveAmplifier) {
+      assert(contextProviderKit);
+
+      // Amplify a facet to a cohort
+      const amplify = exoFacet => {
+        for (const cp of values(contextProviderKit)) {
+          const context = cp(exoFacet);
+          if (context !== undefined) {
+            return context.facets;
+          }
+        }
+        throw Fail`Must be a facet of ${q(tag)}: ${exoFacet}`;
+      };
+      harden(amplify);
+      receiveAmplifier(amplify);
+    }
+
+    if (receiveInstanceTester) {
+      if (multifaceted) {
+        assert(contextProviderKit);
+
+        const isInstance = (exoFacet, facetName = undefined) => {
+          if (facetName === undefined) {
+            // Is exoFacet and instance of any facet of this class kit?
+            return values(contextProviderKit).some(
+              cp => cp(exoFacet) !== undefined,
+            );
+          }
+          // Is this exoFacet an instance of this specific facet column
+          // of this class kit?
+          assert.typeof(facetName, 'string');
+          const cp = contextProviderKit[facetName];
+          cp !== undefined ||
+            Fail`exo class kit ${q(tag)} has no facet named ${q(facetName)}`;
+          return cp(exoFacet) !== undefined;
+        };
+        harden(isInstance);
+        receiveInstanceTester(isInstance);
+      } else {
+        assert(contextProvider);
+        // Is this exo an instance of this class?
+        const isInstance = (exo, facetName = undefined) => {
+          facetName === undefined ||
+            Fail`facetName can only be used with an exo class kit: ${q(
+              tag,
+            )} has no facet ${q(facetName)}`;
+          return contextProvider(exo) !== undefined;
+        };
+        harden(isInstance);
+        receiveInstanceTester(isInstance);
+      }
+    }
+
     return makeNewInstance;
   };
 
@@ -1082,6 +1197,7 @@ export const makeVirtualObjectManager = (
     return id;
   };
 
+  /** @type {import('./vatDataTypes').VatData['defineKind']} */
   const defineKind = (tag, init, behavior, options) => {
     const kindID = `${allocateExportID()}`;
     saveVirtualKindDescriptor(kindID, { kindID, tag });
@@ -1097,6 +1213,7 @@ export const makeVirtualObjectManager = (
     );
   };
 
+  /** @type {import('./vatDataTypes').VatData['defineKindMulti']} */
   const defineKindMulti = (tag, init, behavior, options) => {
     const kindID = `${allocateExportID()}`;
     saveVirtualKindDescriptor(kindID, { kindID, tag });
@@ -1115,7 +1232,7 @@ export const makeVirtualObjectManager = (
   /**
    *
    * @param {string} tag
-   * @returns {import('@agoric/vat-data').DurableKindHandle}
+   * @returns {DurableKindHandle}
    */
   const makeKindHandle = tag => {
     assert(kindIDID, 'initializeKindHandleKind not called yet');
@@ -1126,9 +1243,9 @@ export const makeVirtualObjectManager = (
     nextInstanceIDs.set(kindID, nextInstanceID);
     saveDurableKindDescriptor(durableKindDescriptor);
     saveNextInstanceID(kindID);
-    /** @type {import('@agoric/vat-data').DurableKindHandle} */
-    // eslint-disable-next-line @typescript-eslint/prefer-ts-expect-error -- https://github.com/Agoric/agoric-sdk/issues/4620
-    // @ts-ignore cast
+    /** @type {DurableKindHandle} */
+
+    // @ts-expect-error cast
     const kindHandle = Far('kind', {});
     kindHandleToID.set(kindHandle, kindID);
     const kindIDvref = makeBaseRef(kindIDID, kindID, true);
@@ -1136,6 +1253,7 @@ export const makeVirtualObjectManager = (
     return kindHandle;
   };
 
+  /** @type {import('./vatDataTypes').VatData['defineDurableKind']} */
   const defineDurableKind = (kindHandle, init, behavior, options) => {
     kindHandleToID.has(kindHandle) || Fail`unknown handle ${kindHandle}`;
     const kindID = kindHandleToID.get(kindHandle);
@@ -1158,6 +1276,7 @@ export const makeVirtualObjectManager = (
     return maker;
   };
 
+  /** @type {import('./vatDataTypes').VatData['defineDurableKindMulti']} */
   const defineDurableKindMulti = (kindHandle, init, behavior, options) => {
     kindHandleToID.has(kindHandle) || Fail`unknown handle ${kindHandle}`;
     const kindID = kindHandleToID.get(kindHandle);

package/src/virtualReferences.js

@@ -682,6 +682,54 @@ export function makeVirtualReferenceManager(
     return size;
   }
 
+  /**
+   * Counters to track the next number for various categories of allocation.
+   * `exportID` starts at 1 because 'o+0' is always automatically
+   * pre-assigned to the root object.
+   * `promiseID` starts at 5 as a very minor aid to debugging: when puzzling
+   * over trace logs and the like, it helps for the numbers in various species
+   * of IDs that are jumbled together to be a little out of sync and thus a
+   * little less similar to each other.
+   */
+  const initialIDCounters = { exportID: 1, collectionID: 1, promiseID: 5 };
+  /** @type {Record<string, number>} */
+  let idCounters;
+  let idCountersAreDirty = false;
+
+  function initializeIDCounters() {
+    if (!idCounters) {
+      // the saved value might be missing, or from an older liveslots
+      // (with fewer counters), so merge it with our initial values
+      const saved = JSON.parse(syscall.vatstoreGet('idCounters') || '{}');
+      idCounters = { ...initialIDCounters, ...saved };
+      idCountersAreDirty = true;
+    }
+  }
+
+  function allocateNextID(name) {
+    if (!idCounters) {
+      // Normally `initializeIDCounters` would be called from startVat, but some
+      // tests bypass that so this is a backstop.  Note that the invocation from
+      // startVat is there to make vatStore access patterns a bit more
+      // consistent from one vat to another, principally as a confusion
+      // reduction measure in service of debugging; it is not a correctness
+      // issue.
+      initializeIDCounters();
+    }
+    const result = idCounters[name];
+    result !== undefined || Fail`unknown idCounters[${name}]`;
+    idCounters[name] += 1;
+    idCountersAreDirty = true;
+    return result;
+  }
+
+  function flushIDCounters() {
+    if (idCountersAreDirty) {
+      syscall.vatstoreSet('idCounters', JSON.stringify(idCounters));
+      idCountersAreDirty = false;
+    }
+  }
+
   const testHooks = {
     getReachableRefCount,
     countCollectionsForWeakKey,
@@ -726,6 +774,9 @@ export function makeVirtualReferenceManager(
     ceaseRecognition,
     setDeleteCollectionEntry,
     getRetentionStats,
+    initializeIDCounters,
+    allocateNextID,
+    flushIDCounters,
     testHooks,
   });
 }

package/src/watchedPromises.js

@@ -1,11 +1,19 @@
+// @ts-check
 // no-lonely-if is a stupid rule that really should be disabled globally
 /* eslint-disable no-lonely-if */
 
+import { Fail } from '@endo/errors';
+import { E } from '@endo/eventual-send';
 import { assert } from '@agoric/assert';
 import { initEmpty, M } from '@agoric/store';
-import { E } from '@endo/eventual-send';
 import { parseVatSlot } from './parseVatSlots.js';
 
+/**
+ * @template V
+ * @template {any[]} [A=unknown[]]
+ * @typedef {[watcher: import('./types.js').PromiseWatcher<V, A>, ...args: A]} PromiseWatcherTuple
+ */
+
 /**
  * @param {object} options
  * @param {*} options.syscall
@@ -28,17 +36,28 @@ export function makeWatchedPromiseManager({
   const { makeScalarBigMapStore } = collectionManager;
   const { defineDurableKind } = vom;
 
-  // virtual Store (not durable) mapping vpid to Promise objects, to
-  // maintain the slotToVal registration until resolution. Without
-  // this, slotToVal would forget local Promises that aren't exported.
+  /**
+   * virtual Store (not durable) mapping vpid to Promise objects, to
+   * maintain the slotToVal registration until resolution. Without
+   * this, slotToVal would forget local Promises that aren't exported.
+   *
+   * @type {MapStore<string, Promise<unknown>>}
+   */
   let promiseRegistrations;
 
-  // watched promises by vpid: each entry is an array of watches on the
-  // corresponding vpid; each of these is in turn an array of a watcher object
-  // and the arguments associated with it by `watchPromise`.
+  /**
+   * watched promises by vpid: each entry is an array of watches on the
+   * corresponding vpid; each of these is in turn an array of a watcher object
+   * and the arguments associated with it by `watchPromise`.
+   * @type {MapStore<string, PromiseWatcherTuple<unknown>[]>}
+   */
   let watchedPromiseTable;
 
-  // defined promise watcher objects indexed by kindHandle
+  /**
+   * defined promise watcher objects indexed by kindHandle
+   *
+   * @type {MapStore<import('./vatDataTypes.js').DurableKindHandle, import('./types.js').PromiseWatcher<unknown>>}
+   */
   let promiseWatcherByKindTable;
 
   function preparePromiseWatcherTables() {
@@ -73,11 +92,17 @@ export function makeWatchedPromiseManager({
   }
 
   /**
-   *
-   * @param {Promise<unknown>} p
+   * @template T
+   * @param {Promise<T>} p
    * @param {string} vpid
+   * @returns {void}
    */
   function pseudoThen(p, vpid) {
+    /**
+     *
+     * @param {T} value
+     * @param {boolean} wasFulfilled
+     */
     function settle(value, wasFulfilled) {
       const watches = watchedPromiseTable.get(vpid);
       watchedPromiseTable.delete(vpid);
@@ -121,20 +146,28 @@ export function makeWatchedPromiseManager({
     }
   }
 
+  /**
+   * @template V
+   * @template {any[]} A]
+   * @param {import('./vatDataTypes.js').DurableKindHandle} kindHandle
+   * @param {(value: V, ...args: A) => void} fulfillHandler
+   * @param {(reason: any, ...args: A) => void} rejectHandler
+   * @returns {import('./types.js').PromiseWatcher<V, A>}
+   */
   function providePromiseWatcher(
     kindHandle,
-    fulfillHandler = x => x,
-    rejectHandler = x => {
-      throw x;
-    },
+    // @ts-expect-error xxx rest params in typedef
+    fulfillHandler = _value => {},
+    // @ts-expect-error xxx rest params in typedef
+    rejectHandler = _reason => {},
   ) {
     assert.typeof(fulfillHandler, 'function');
     assert.typeof(rejectHandler, 'function');
 
     const makeWatcher = defineDurableKind(kindHandle, initEmpty, {
-      // @ts-expect-error  TS is confused by the spread operator
+      /** @type {(context: unknown, res: V, ...args: A) => void} */
       onFulfilled: (_context, res, ...args) => fulfillHandler(res, ...args),
-      // @ts-expect-error
+      /** @type {(context: unknown, rej: unknown, ...args: A) => void} */
       onRejected: (_context, rej, ...args) => rejectHandler(rej, ...args),
     });
 
@@ -147,6 +180,9 @@ export function makeWatchedPromiseManager({
     }
   }
 
+  /**
+   * @type {<P extends Promise<any>, A extends any[]>(p: P, watcher: import('./types.js').PromiseWatcher<Awaited<P>, A>, ...args: A) => void}
+   */
   function watchPromise(p, watcher, ...args) {
     // The following wrapping defers setting up the promise watcher itself to a
     // later turn so that if the promise to be watched was the return value from
@@ -163,7 +199,10 @@ export function makeWatchedPromiseManager({
       const watcherVref = convertValToSlot(watcher);
       assert(watcherVref, 'invalid watcher');
       const { virtual, durable } = parseVatSlot(watcherVref);
-      assert(virtual || durable, 'promise watcher must be a virtual object');
+      virtual ||
+        durable ||
+        // separate line so easy to breakpoint on
+        Fail`promise watcher must be a virtual object`;
       if (watcher.onFulfilled) {
         assert.typeof(watcher.onFulfilled, 'function');
       }

package/test/{test-baggage.js → baggage.test.js}

@@ -1,10 +1,9 @@
 import test from 'ava';
-import '@endo/init/debug.js';
 
 import { Far } from '@endo/marshal';
+import { kunser } from '@agoric/kmarshal';
 import { setupTestLiveslots } from './liveslots-helpers.js';
 import { vstr } from './util.js';
-import { kunser } from './kmarshal.js';
 import { parseVatSlot } from '../src/parseVatSlots.js';
 
 function buildRootObject(vatPowers, vatParameters, baggage) {

package/test/{test-cache.js → cache.test.js}

@@ -1,5 +1,4 @@
 import test from 'ava';
-import '@endo/init/debug.js';
 
 import { makeCache } from '../src/cache.js';